一句话：提出 TypeFSL，用过程间数据流切片与少样本学习从剥离二进制中恢复类型，缓解类型分布不均衡。
剥离二进制中的类型恢复是逆向工程中的关键且富有挑战性的任务，也是漏洞检测等安全应用的基础。传统分析方法受限于软件复杂度与真实项目中的新兴类型，而现有监督学习因样本有限难以处理复杂和不常见类型，且无法捕捉二进制中细粒度与过程间特征。本文提出 TypeFSL，通过引入少样本学习应对类型分布不均衡，并利用程序切片捕捉过程间语义，结合过程间数据流分析进行类型预测。基于包含 3,003,117 个函数的数据集，TypeFSL 在 20-way 5-shot 和 10-shot 分类任务中跨所有架构与优化级别平均分别达到 77.9% 和 84.6% 的准确率，在预测准确率和抗混淆能力上优于现有技术，案例研究进一步展示了对不常见和复杂类型的实际预测效果。
Type recovery in stripped binaries is a critical and challenging task in reverse engineering, as it is the basis for many security applications (e.g., vulnerability detection). Traditional analysis methods are limited by software complexity and emerging types in real-world projects. To address these limitations, machine learning methods have been explored. However, the existing supervised learning approaches struggle with analyzing complicated and uncommon types due to the limited availability of samples. Additionally, none of the existing works can capture fine-grained and inter-procedural features in the binaries. In this paper, we present TypeFSL, a framework that addresses the challenge of imbalanced type distributions by incorporating few-shot learning and captures inter-procedural semantics through program slicing. Moreover, based on a dataset with 3,003,117 functions, TypeFSL achieves an average of 77.9% and 84.6% accuracy across all architecture and optimizations in 20-way 5-shot and 10-shot classification tasks. Our prototype outperforms existing techniques in prediction accuracy and obfuscation resistance. Finally, the case studies demonstrate how TypeFSL predicts uncommon and complicated types in practical analysis.
@inproceedings{paperbot8373,
title = {TypeFSL: Type Prediction from Binaries via Inter-procedural Data-flow Analysis and Few-shot Learning},
author = {Zirui Song and YuTong Zhou and Shuaike Dong and Ke Zhang and Kehuan Zhang},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695502}
}